As you and I take a look at the problems that can come up
with getting access via the VTY lines,
we have most of the similar problems that
could be applied to the console line including
the authentication issues like that.
But in the case of the VTY line, we also
the issue of connectivity, getting to the device so
we can get access via a VTY line.
Whether it's telnet or SSH.
And so in this video, I like to walk you
through several of the challenges
and how to resolve them if we're troubleshooting, getting
access, and working with VTY lines on a Cisco router WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
access, and working with VTY lines on a Cisco router
or switch.
And these concepts regarding access via VTY lines
are applicable whether that's a router or a switch.
One of the very first things we'd want to make sure
is is that, OK, for trying to connect
on the VTY lines via telnet or SSH,
is that protocol allowed logically on the VTY lines?
Because if the transport input is
specified for SSH only and nothing else,
well, that's not going to work.
Or if we don't have the SSH permitted,
that's not going to work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's not going to work.
Or if the SSH is not enabled, we haven't
gone through the steps of enabling SSH, again,
that's not going to work.
Or on the VTY lines, if there's an access control list
specifying who, what source address can connect,
and we're not in that range, that could be an issue as well,
including all the other aspects that we
talked about when the previous video regarding AAA.
The method list, which method this is being used?
Can R1 access a radio server?
Is it setup correctly or can it access a TACACS server?
Is it set up correctly?
So I thought for this discussion, let's do this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I thought for this discussion, let's do this.
Let me take you to one of the routers
I have here in my playground, in my office.
About a few months ago, a friend of mine, his name is Trevor,
said, you're in my DNVPN network.
And we've been just putting gear online
and doing a DNVPN and lots of fun stuff.
And he is amazing.
He's got lots of things going on,
including authentication with an ICE server and the rest.
I thought, let me leverage this.
Let's go take a look at R1.
We'll take a look at its config for the VTY lines. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll take a look at its config for the VTY lines.
And then we'll walk through some steps and also some inside tips
on how we could do testing if things aren't working
quite the way we expect with AAA and with authentication
for VTY access on a device.
So there is my Switch I just rebooted.
Let me go ahead and close him.
And let's go down to PuTTY.
And let me open up a connection to R1.
Let me load it so we can see the settings.
So it's connecting to this IP address via SSH on port 22.
That's all based on my terminal emulator.
That all looks good.
We'll click on Open. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll click on Open.
And it's asking me to authenticate.
So because I'm connecting to this router--
I need to moved over here.
And I will resize this a little bit.
All right.
So because we're connected to this router over the IP
network via SSH, we are logically
connecting in one of the VTY lines.
So whatever the requirements are and restrictions
on the VTY lines, that's what I'm getting right here.
So in this case, it's using a TACACS server
or a group of TACACS servers for authentication.
So I'm going to log in as K. Barker.
And my-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And my--
[CHUCKLES]
And there's a warning banner.
And then my password is cisco123.
I'm kidding.
That's not my password.
This is part of a live network.
So I'm now logged in.
If we do a show users, it now shows me
that my username, K. Barker, is logged in.
I'm coming in from-- this is my source address of the PC
I'M sitting at right here as I'm connecting to that.
And I'm logically connected on VTY line 0.
So if we take a look at what are the requirements for VTY line
0, we just show run, and we'll just section line VTY. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
0, we just show run, and we'll just section line VTY.
It's a long way of getting there pretty quick.
And here's our VTY line configurations.
And they're identical.
I've got 0 starting right here all the way through 15.
So 16 VTY lines that we can use.
And exec time out.
That's just so my sessions will not time out for 30 minutes.
Not bad.
So anyway, a privilege level to 15
may not be the best thing for a production environment,
but because I'm allowing a lot of things here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but because I'm allowing a lot of things here,
it is set for 15.
And also, regarding authorization and accounting,
there is a method list called ise, which is pointing back
with TACACAS to a AAA server, an ICE server, for authorization
and for accounting.
But the focus I want to look at right
here was the log in authentication
and also the transport input SSH.
So SSH is allowed on this device.
We've had other videos in this series
of troubleshooting on how to make sure you get SSH working.
We learn about the basics of that in CCNA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We learn about the basics of that in CCNA.
And in other videos, we've taken a look
at implementing SSH with a domain name
and specifying the modulus, and then making sure
we've allowed it on a VTY line.
And then, this. is the part right here.
Log in authentication ise.
What does that mean?
Well, log in authentication ise-- ise is a method list.
So if we do a show run, and we'll do a section AAA.
I said section AAA.
Where is the voice recognition?
So we do section AAA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we do section AAA.
Fantastic.
So here's AAA new model and here is a TACACS server group that
has a couple of servers in it.
And then, here I have this AAA authentication method
list for login authentication.
And its name is ise and it's using a group of servers.
And if it can't reach that group of servers,
it's then going to access the local database, which
is a great reason as a backup why we should have a local user
account.
So if we can't reach TACACS servers or our radius servers,
whatever we're using, we won't be locked out WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
whatever we're using, we won't be locked out
like I was back in 2003 in my lab.
Oh my gosh.
And I did it to myself.
I threw in some AAA commands, I came back,
and I could not log in.
There was no way.
And I had to do pass recovery right there in the lab
so I could recover that device.
Not good.
I lost about maybe 20, 25 minutes overall based
on that process.
OK.
So let's verify a couple of things.
So if we are using this group called JANTECHS
and it's got those two servers in it,
JANTECHS and JANTECHS-SEC, how do we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
JANTECHS and JANTECHS-SEC, how do we
verify that that's working?
One way-- this is really cool-- is do test.
This command is underused and so important.
Before we start using AAA to authenticate users,
whether it's radius or TACACS plus,
we want to make sure that is working.
That means we have the TACACS or radius server setup correctly.
It's willing to talk to this router
and we have all the keys set up back and forth so
that they'll be able to do authentication
check with each other.
So if we do a test, look at this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we do a test, look at this.
We're going to do a test AAA.
And let's go ahead and do a group and test our radius.
I'm just following the bouncing ball here.
And let's test Bob.
And let's test this password of capital Cisco!23.
Just so you know, I asked Trevor to just temporarily create
this user account so it's not going
to be there in perpetuity.
So it's going to be gone after--
well before this video is released.
All right. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right.
So test AAA group radius TACACS--
AAA, oh, I want to test via TACACS.
Back up there.
TACACS.
And then the username Bob, password Cisco123, and then
we'll go ahead and use new code.
Oh and I lost my connectivity to the router.
Oh, bummer.
Let me go ahead and copy that because I have to do it again.
I've got a lot of stuff going on here.
And this is totally my fault. And we'll go ahead
and we'll do a restart session.
All right.
And let me just show users. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let me just show users.
All right.
So there's my previous session.
Still good, so I can do a clear line 194.
All right.
So I lost my connectivity in that VTY line.
It would be active for 30 minutes,
so I just killed it right there.
All right, so let's do our test again.
Test AAA group TACACS, username is going to be Bob
and the password is Cisco!23, new code. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the password is Cisco!23, new code.
And here you might ask, well, do I use new code or legacy?
What do I use?
Well, you try one, it doesn't work, try the other one.
Most of the times, on fairly current gear
new code should be fine.
And then press Enter.
And that should-- look at that.
Username Bob, and AD password.
And so that means it's successful.
That means that this router can successfully
communicate with that AAA server, that TACACS server,
in this case.
And that's a good step to take before we start rolling it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's a good step to take before we start rolling it
out and also making sure we have that backup in our method list
so that we don't lock ourselves out in the future.
So if we want another tip is we go terminal.
I always forget to do this.
Terminal monitor-- because I'm VTY'd in,
I want to see the console messages on the screen.
So terminal monitor will give me that.
And we can also do a debug of AAA authentication.
And now that's on, we could type in Exit.
And I'll bring up another session.
It's going to ask me to authenticate again.
And then because we have the debug of authentication, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then because we have the debug of authentication,
and we can do a show log, and it should all
be sitting there for us.
So debug AAA authentication is on.
And let me do a terminal monitor as well, right?
So I'm going to do an SSH.
So SSH -l for login, and we log in as K. Barker.
Actually, I can log in as Bob.
He's got access.
And then, from here, we can specify the parameters.
So if, for example, we had to force SSH version 1
or force SSH version 2 or specify a specific algorithm,
we could do that here for our access in if we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we could do that here for our access in if we
were trying to troubleshoot.
And if we weren't sure, we could just
step through and try a few different options to get in.
Like if we do a -v and say, I want
to go in with SSH version 2, that's how we do it.
And I'm going to go ahead and specify
the IP address of this device, which is 182.168.1.11.
And they're asking me to authenticate
as Bob, which is great.
And we have the debugs coming through as well
regarding that authentication.
So it uses the method list called
ise, which is on the system. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ise, which is on the system.
And we do a show users.
I've now got Bob on VTY 1 and I've got myself on VTY 0.
So part of troubleshooting with the remote access for the VTY
lines is, test locally first.
If we're using SSH, make sure SSH works first
right there local.
Make sure that your method lists include a local option
as a fallback in case they cannot reach,
the method list can't reach a TACACS or a radius server
group.
Verify that all works beforehand.
And then use the test AAA command to verify interactivity WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then use the test AAA command to verify interactivity
with those devices.
I guess the secret is to test and try
before you set up the AAA so you do not lock yourself
out and have to do pass recovery to get back into a box.
So thanks for joining me in this video
on remote access via VTY lines and a few of the things
that can go wrong.
And I'll see you in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.